VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jun 25, 2026· Updated Jun 27, 2026

CVE-2026-6681

CVE-2026-6681

Description

The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release.

Affected products

2
  • WolfSSL/Wolfssl2 versions
    cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*range: >=3.10.0,<5.9.1
    • (no CPE)range: <=5.9.0

Patches

Vulnerability mechanics

References

2

News mentions

1